Modern day operating systems have a history of security weaknesses that allow malicious code and users to attack a computer system using numerous available techniques. For example, one type of attack works by tricking an authorized user into executing malicious code on a computer system. Various techniques have been developed for preventing these attacks. For example, one technique modifies, or hooks, the behavior of the computer system in a way that specifically prevents these attacks from working.
Hooking applications are becoming increasingly popular, especially in the security and network management arts. Such hooking applications are adapted for hooking various aspects of an interface. By way of example, some of such applications are capable of hooking application program interface (API) calls.
Such API hooking is a technique where an API is modified so that subsequent invocations of a particular function transfers control to a handler. This handler may then, in turn, analyze the original API invocation, report usage of the API, modify relevant parameters, etc. Further, in the case of security applications, API hooking may serve to enable a decision as to allowing or disallowing the original API to be invoked.
Unfortunately, however, present hooking applications do not deal efficiently with attacks that involve user mode code execution. There is thus a need for overcoming these and/or other problems associated with the prior art.